<!DOCTYPE html>
<html lang="en-US">
<head>

<link rel="profile" href="http://gmpg.org/xfn/11"/>
<link rel="pingback" href="https://blog.lumen.com/xmlrpc.php"/>

 

<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1'/>

	<!-- This site is optimized with the Yoast SEO plugin v19.6.1 - https://yoast.com/wordpress/plugins/seo/ -->
	<title>Chaos is a Go-based Swiss army knife of malware - Lumen</title>
	<meta name="description" content="Black Lotus Labs, the threat intelligence arm of Lumen Technologies, recently uncovered a multifunctional Go-based malware developed for Windows and Linux"/>
	<link rel="canonical" href="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"/>
	<meta property="og:locale" content="en_US"/>
	<meta property="og:type" content="article"/>
	<meta property="og:title" content="Chaos is a Go-based Swiss army knife of malware - Lumen"/>
	<meta property="og:description" content="Black Lotus Labs, the threat intelligence arm of Lumen Technologies, recently uncovered a multifunctional Go-based malware developed for Windows and Linux"/>
	<meta property="og:url" content="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"/>
	<meta property="og:site_name" content="Lumen"/>
	<meta property="article:published_time" content="2022-09-28T13:30:22+00:00"/>
	<meta property="article:modified_time" content="2022-09-28T15:14:15+00:00"/>
	<meta property="og:image" content="https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg"/>
	<meta property="og:image:width" content="848"/>
	<meta property="og:image:height" content="566"/>
	<meta property="og:image:type" content="image/jpeg"/>
	<meta name="author" content="Black Lotus Labs"/>
	<meta name="twitter:card" content="summary_large_image"/>
	<meta name="twitter:label1" content="Written by"/>
	<meta name="twitter:data1" content="Black Lotus Labs"/>
	<meta name="twitter:label2" content="Est. reading time"/>
	<meta name="twitter:data2" content="16 minutes"/>
	<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebPage","@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/","url":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/","name":"Chaos is a Go-based Swiss army knife of malware - Lumen","isPartOf":{"@id":"https://blog.lumen.com/#website"},"primaryImageOfPage":{"@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#primaryimage"},"image":{"@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#primaryimage"},"thumbnailUrl":"https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg","datePublished":"2022-09-28T13:30:22+00:00","dateModified":"2022-09-28T15:14:15+00:00","author":{"@id":"https://blog.lumen.com/#/schema/person/9b26b108f2dede9b8080aca43fb23283"},"description":"Black Lotus Labs, the threat intelligence arm of Lumen Technologies, recently uncovered a multifunctional Go-based malware developed for Windows and Linux","breadcrumb":{"@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#primaryimage","url":"https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg","contentUrl":"https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg","width":848,"height":566,"caption":"World map with red target on Europe and points on other cities"},{"@type":"BreadcrumbList","@id":"https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://blog.lumen.com/"},{"@type":"ListItem","position":2,"name":"Sample post page","item":"https://blog.lumen.com/?page_id=4365"},{"@type":"ListItem","position":3,"name":"Chaos is a Go-based Swiss army knife of malware"}]},{"@type":"WebSite","@id":"https://blog.lumen.com/#website","url":"https://blog.lumen.com/","name":"Lumen","description":"Lumen&#039;s Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://blog.lumen.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https://blog.lumen.com/#/schema/person/9b26b108f2dede9b8080aca43fb23283","name":"Black Lotus Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://blog.lumen.com/#/schema/person/image/","url":"https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-100x100.png","contentUrl":"https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-100x100.png","caption":"Black Lotus Labs"},"description":"The mission of Black Lotus Labs is to leverage our network visibility to help protect customers and keep the internet clean.","url":"https://blog.lumen.com/author/black-lotus-labs/"}]}</script>
	<!-- / Yoast SEO plugin. -->


<link rel='dns-prefetch' href='//static.addtoany.com'/>
<link rel='dns-prefetch' href='//players.brightcove.net'/>
<link rel='dns-prefetch' href='//fonts.googleapis.com'/>
<link rel='dns-prefetch' href='//s.w.org'/>
<link rel='dns-prefetch' href='//www.googletagmanager.com'/>
<link rel="alternate" type="application/rss+xml" title="Lumen &raquo; Feed" href="https://blog.lumen.com/feed/"/>
<meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/><meta name="format-detection" content="telephone=no"><meta property="og:type" content="article"/><meta property="og:image" content="https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg"/><meta property="og:title" content="Chaos is a Go-based Swiss army knife of malware"/><meta property="og:url" content="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"/><meta property="og:description" content=""/>		<!-- This site uses the Google Analytics by MonsterInsights plugin v8.8.2 - Using Analytics tracking - https://www.monsterinsights.com/ -->
							<script src="//www.googletagmanager.com/gtag/js?id=UA-41153014-24" data-cfasync="false" data-wpfc-render="false" type="text/javascript" async></script>
			<script data-cfasync="false" data-wpfc-render="false" type="text/javascript">var mi_version='8.8.2';var mi_track_user=true;var mi_no_track_reason='';var disableStrs=['ga-disable-UA-41153014-24',];function __gtagTrackerIsOptedOut(){for(var index=0;index<disableStrs.length;index++){if(document.cookie.indexOf(disableStrs[index]+'=true')>-1){return true;}}return false;}if(__gtagTrackerIsOptedOut()){for(var index=0;index<disableStrs.length;index++){window[disableStrs[index]]=true;}}function __gtagTrackerOptout(){for(var index=0;index<disableStrs.length;index++){document.cookie=disableStrs[index]+'=true; expires=Thu, 31 Dec 2099 23:59:59 UTC; path=/';window[disableStrs[index]]=true;}}if('undefined'===typeof gaOptout){function gaOptout(){__gtagTrackerOptout();}}window.dataLayer=window.dataLayer||[];window.MonsterInsightsDualTracker={helpers:{},trackers:{},};if(mi_track_user){function __gtagDataLayer(){dataLayer.push(arguments);}function __gtagTracker(type,name,parameters){if(!parameters){parameters={};}if(parameters.send_to){__gtagDataLayer.apply(null,arguments);return;}if(type==='event'){parameters.send_to=monsterinsights_frontend.ua;__gtagDataLayer(type,name,parameters);}else{__gtagDataLayer.apply(null,arguments);}}__gtagTracker('js',new Date());__gtagTracker('set',{'developer_id.dZGIzZG':true,});__gtagTracker('config','UA-41153014-24',{"forceSSL":"true","link_attribution":"true"});window.gtag=__gtagTracker;(function(){var noopfn=function(){return null;};var newtracker=function(){return new Tracker();};var Tracker=function(){return null;};var p=Tracker.prototype;p.get=noopfn;p.set=noopfn;p.send=function(){var args=Array.prototype.slice.call(arguments);args.unshift('send');__gaTracker.apply(null,args);};var __gaTracker=function(){var len=arguments.length;if(len===0){return;}var f=arguments[len-1];if(typeof f!=='object'||f===null||typeof f.hitCallback!=='function'){if('send'===arguments[0]){var hitConverted,hitObject=false,action;if('event'===arguments[1]){if('undefined'!==typeof arguments[3]){hitObject={'eventAction':arguments[3],'eventCategory':arguments[2],'eventLabel':arguments[4],'value':arguments[5]?arguments[5]:1,}}}if('pageview'===arguments[1]){if('undefined'!==typeof arguments[2]){hitObject={'eventAction':'page_view','page_path':arguments[2],}}}if(typeof arguments[2]==='object'){hitObject=arguments[2];}if(typeof arguments[5]==='object'){Object.assign(hitObject,arguments[5]);}if('undefined'!==typeof arguments[1].hitType){hitObject=arguments[1];if('pageview'===hitObject.hitType){hitObject.eventAction='page_view';}}if(hitObject){action='timing'===arguments[1].hitType?'timing_complete':hitObject.eventAction;hitConverted=mapArgs(hitObject);__gtagTracker('event',action,hitConverted);}}return;}function mapArgs(args){var arg,hit={};var gaMap={'eventCategory':'event_category','eventAction':'event_action','eventLabel':'event_label','eventValue':'event_value','nonInteraction':'non_interaction','timingCategory':'event_category','timingVar':'name','timingValue':'value','timingLabel':'event_label','page':'page_path','location':'page_location','title':'page_title',};for(arg in args){if(!(!args.hasOwnProperty(arg)||!gaMap.hasOwnProperty(arg))){hit[gaMap[arg]]=args[arg];}else{hit[arg]=args[arg];}}return hit;}try{f.hitCallback();}catch(ex){}};__gaTracker.create=newtracker;__gaTracker.getByName=newtracker;__gaTracker.getAll=function(){return[];};__gaTracker.remove=noopfn;__gaTracker.loaded=true;window['__gaTracker']=__gaTracker;})();}else{console.log("");(function(){function __gtagTracker(){return null;}window['__gtagTracker']=__gtagTracker;window['gtag']=__gtagTracker;})();}</script>
				<!-- / Google Analytics by MonsterInsights -->
		<script type="text/javascript">window._wpemojiSettings={"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/blog.lumen.com\/wp-includes\/js\/wp-emoji-release.min.js"}};!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode,e=(p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0),i.toDataURL());return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p||!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([129777,127995,8205,129778,127999],[129777,127995,8203,129778,127999])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything||(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(e=t.source||{}).concatemoji?c(e.concatemoji):e.wpemoji&&e.twemoji&&(c(e.twemoji),c(e.wpemoji)))}(window,document,window._wpemojiSettings);</script>
<style type="text/css">img.wp-smiley,img.emoji{display:inline!important;border:none!important;box-shadow:none!important;height:1em!important;width:1em!important;margin:0 .07em!important;vertical-align:-.1em!important;background:none!important;padding:0!important}</style>
	<link rel='stylesheet' id='wp-block-library-css' href='https://blog.lumen.com/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all'/>
<style id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black:#000;--wp--preset--color--cyan-bluish-gray:#abb8c3;--wp--preset--color--white:#fff;--wp--preset--color--pale-pink:#f78da7;--wp--preset--color--vivid-red:#cf2e2e;--wp--preset--color--luminous-vivid-orange:#ff6900;--wp--preset--color--luminous-vivid-amber:#fcb900;--wp--preset--color--light-green-cyan:#7bdcb5;--wp--preset--color--vivid-green-cyan:#00d084;--wp--preset--color--pale-cyan-blue:#8ed1fc;--wp--preset--color--vivid-cyan-blue:#0693e3;--wp--preset--color--vivid-purple:#9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple:linear-gradient(135deg,rgba(6,147,227,1) 0%,#9b51e0 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan:linear-gradient(135deg,#7adcb4 0%,#00d082 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange:linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red:linear-gradient(135deg,rgba(255,105,0,1) 0%,#cf2e2e 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray:linear-gradient(135deg,#eee 0%,#a9b8c3 100%);--wp--preset--gradient--cool-to-warm-spectrum:linear-gradient(135deg,#4aeadc 0%,#9778d1 20%,#cf2aba 40%,#ee2c82 60%,#fb6962 80%,#fef84c 100%);--wp--preset--gradient--blush-light-purple:linear-gradient(135deg,#ffceec 0%,#9896f0 100%);--wp--preset--gradient--blush-bordeaux:linear-gradient(135deg,#fecda5 0%,#fe2d2d 50%,#6b003e 100%);--wp--preset--gradient--luminous-dusk:linear-gradient(135deg,#ffcb70 0%,#c751c0 50%,#4158d0 100%);--wp--preset--gradient--pale-ocean:linear-gradient(135deg,#fff5cb 0%,#b6e3d4 50%,#33a7b5 100%);--wp--preset--gradient--electric-grass:linear-gradient(135deg,#caf880 0%,#71ce7e 100%);--wp--preset--gradient--midnight:linear-gradient(135deg,#020381 0%,#2874fc 100%);--wp--preset--duotone--dark-grayscale:url(#wp-duotone-dark-grayscale);--wp--preset--duotone--grayscale:url(#wp-duotone-grayscale);--wp--preset--duotone--purple-yellow:url(#wp-duotone-purple-yellow);--wp--preset--duotone--blue-red:url(#wp-duotone-blue-red);--wp--preset--duotone--midnight:url(#wp-duotone-midnight);--wp--preset--duotone--magenta-yellow:url(#wp-duotone-magenta-yellow);--wp--preset--duotone--purple-green:url(#wp-duotone-purple-green);--wp--preset--duotone--blue-orange:url(#wp-duotone-blue-orange);--wp--preset--font-size--small:13px;--wp--preset--font-size--medium:20px;--wp--preset--font-size--large:36px;--wp--preset--font-size--x-large:42px}.has-black-color{color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-color{color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-color{color:var(--wp--preset--color--white)!important}.has-pale-pink-color{color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-color{color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-color{color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-color{color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-color{color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-color{color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-color{color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-color{color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-color{color:var(--wp--preset--color--vivid-purple)!important}.has-black-background-color{background-color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-background-color{background-color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-background-color{background-color:var(--wp--preset--color--white)!important}.has-pale-pink-background-color{background-color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-background-color{background-color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-background-color{background-color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-background-color{background-color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-background-color{background-color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-background-color{background-color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-background-color{background-color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-background-color{background-color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-background-color{background-color:var(--wp--preset--color--vivid-purple)!important}.has-black-border-color{border-color:var(--wp--preset--color--black)!important}.has-cyan-bluish-gray-border-color{border-color:var(--wp--preset--color--cyan-bluish-gray)!important}.has-white-border-color{border-color:var(--wp--preset--color--white)!important}.has-pale-pink-border-color{border-color:var(--wp--preset--color--pale-pink)!important}.has-vivid-red-border-color{border-color:var(--wp--preset--color--vivid-red)!important}.has-luminous-vivid-orange-border-color{border-color:var(--wp--preset--color--luminous-vivid-orange)!important}.has-luminous-vivid-amber-border-color{border-color:var(--wp--preset--color--luminous-vivid-amber)!important}.has-light-green-cyan-border-color{border-color:var(--wp--preset--color--light-green-cyan)!important}.has-vivid-green-cyan-border-color{border-color:var(--wp--preset--color--vivid-green-cyan)!important}.has-pale-cyan-blue-border-color{border-color:var(--wp--preset--color--pale-cyan-blue)!important}.has-vivid-cyan-blue-border-color{border-color:var(--wp--preset--color--vivid-cyan-blue)!important}.has-vivid-purple-border-color{border-color:var(--wp--preset--color--vivid-purple)!important}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background:var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple)!important}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background:var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan)!important}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background:var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange)!important}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background:var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red)!important}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background:var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray)!important}.has-cool-to-warm-spectrum-gradient-background{background:var(--wp--preset--gradient--cool-to-warm-spectrum)!important}.has-blush-light-purple-gradient-background{background:var(--wp--preset--gradient--blush-light-purple)!important}.has-blush-bordeaux-gradient-background{background:var(--wp--preset--gradient--blush-bordeaux)!important}.has-luminous-dusk-gradient-background{background:var(--wp--preset--gradient--luminous-dusk)!important}.has-pale-ocean-gradient-background{background:var(--wp--preset--gradient--pale-ocean)!important}.has-electric-grass-gradient-background{background:var(--wp--preset--gradient--electric-grass)!important}.has-midnight-gradient-background{background:var(--wp--preset--gradient--midnight)!important}.has-small-font-size{font-size:var(--wp--preset--font-size--small)!important}.has-medium-font-size{font-size:var(--wp--preset--font-size--medium)!important}.has-large-font-size{font-size:var(--wp--preset--font-size--large)!important}.has-x-large-font-size{font-size:var(--wp--preset--font-size--x-large)!important}</style>
<link rel='stylesheet' id='uaf_client_css-css' href='https://blog.lumen.com/wp-content/uploads/useanyfont/uaf.css' type='text/css' media='all'/>
<link rel='stylesheet' id='ppress-frontend-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css' type='text/css' media='all'/>
<link rel='stylesheet' id='ppress-flatpickr-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css.pagespeed.ce.kdrnnYR5Hn.css' type='text/css' media='all'/>
<link rel='stylesheet' id='ppress-select2-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-reset-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/reset.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-wordpress-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/wordpress.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-animation-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/animation.css' type='text/css' media='all'/>
<link rel='stylesheet' id='ilightbox-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css' type='text/css' media='all'/>
<link rel='stylesheet' id='jquery-ui-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/jqueryui/custom.css' type='text/css' media='all'/>
<link rel='stylesheet' id='flexslider-css' href='https://blog.lumen.com/wp-content/themes/grandnews/js/flexslider/flexslider.css' type='text/css' media='all'/>
<link rel='stylesheet' id='tooltipster-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/tooltipster.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-screen-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/screen.css' type='text/css' media='all'/>
<style id='grandnews-custom-menu-css-css' media='all'>.header_style_wrapper .top_bar{border-bottom:1px solid #e1e1e1}#wrapper{padding-top:106px}#logo_wrapper{float:left;overflow:visible;width:100%;padding:35px 0 30px 0;display:table}.logo_container{display:block;float:left;width:auto;height:auto;margin-right:15px;display:table-cell;vertical-align:middle}#menu_wrapper{display:block;width:auto;height:100%;display:table-cell;vertical-align:middle}#nav_wrapper{width:auto;height:auto;border:0;text-align:left;float:right}#menu_wrapper .nav ul li>a,#menu_wrapper div .nav li>a{padding:8px 15px 10px 15px;transition:none}#logo_right_button{float:right;padding:8px 0 0 0}.top_bar.scroll #logo_wrapper{height:auto;padding:15px 0 10px 0}.top_bar.scroll #logo_wrapper #custom_logo img{width:auto;max-height:30px}#post_info_bar{height:65px;top:-65px}#post_info_bar .post_info .post_info_label{margin-top:10px}#post_info_bar .post_info,#post_info_bar .post_info_thumb{margin-top:4px}.top_bar.scroll .logo_container{float:none}</style>
<link rel='stylesheet' id='fontawesome-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/font-awesome.min.css' type='text/css' media='all'/>
<link rel='stylesheet' id='brightcove-pip-css-css' href='https://players.brightcove.net/videojs-pip/1/videojs-pip.css' type='text/css' media='all'/>
<style id='brightcove-playlist-css' media='all'>.brightcove-playlist{background-color:#fff;padding:20px 20px 10px 20px;font-size:80%}h3.brightcove-playlist-title{margin:0 0 10px 0}.brightcove-playlist-item{display:table;margin-bottom:20px;border-top:1px solid #eee;padding-top:20px;width:100%}.brightcove-playlist-video-order-id{display:table-cell;vertical-align:middle;width:20px;color:#999}.brightcove-playlist-video-thumbnail{display:table-cell;vertical-align:middle;width:40%;padding-right:20px}.brightcove-playlist-video-meta{display:table-cell;vertical-align:middle}h4.brightcove-playlist-video-title{margin:0}.brightcove-playlist-videodescription{margin:0}</style>
<link rel='stylesheet' id='wp_review-style-css' href='https://blog.lumen.com/wp-content/plugins/wp-review/public/css/wp-review.css' type='text/css' media='all'/>
<style id='addtoany-css' media='all'>.addtoany_content{clear:both;margin:16px auto}.addtoany_header{margin:0 0 16px}.addtoany_list{display:inline;line-height:16px}.addtoany_list a,.widget .addtoany_list a{border:0;box-shadow:none;display:inline-block;font-size:16px;padding:0 4px;vertical-align:middle}.addtoany_list a img{border:0;display:inline-block;opacity:1;overflow:hidden;vertical-align:baseline}.addtoany_list a span{display:inline-block;float:none}.addtoany_list.a2a_kit_size_32 a{font-size:32px}.addtoany_list.a2a_kit_size_32 a:not(.addtoany_special_service)>span{height:32px;line-height:32px;width:32px}.addtoany_list a:not(.addtoany_special_service)>span{border-radius:4px;display:inline-block;opacity:1}.addtoany_list a .a2a_count{position:relative;vertical-align:top}.site .a2a_kit.addtoany_list a:focus,.addtoany_list a:hover,.widget .addtoany_list a:hover{background:none;border:0;box-shadow:none}.addtoany_list a:hover img,.addtoany_list a:hover span{opacity:.7}.addtoany_list a.addtoany_special_service:hover img,.addtoany_list a.addtoany_special_service:hover span{opacity:1}.addtoany_special_service{display:inline-block;vertical-align:middle}.addtoany_special_service a,.addtoany_special_service div,.addtoany_special_service div.fb_iframe_widget,.addtoany_special_service iframe,.addtoany_special_service span{margin:0;vertical-align:baseline!important}.addtoany_special_service iframe{display:inline;max-width:none}a.addtoany_share.addtoany_no_icon span.a2a_img_text{display:none}a.addtoany_share img{border:0;width:auto;height:auto}</style>
<link rel='stylesheet' id='kirki_google_fonts-css' href='https://fonts.googleapis.com/css?family=Roboto%3A800%2C700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic%7CRaleway%3A700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&#038;subset' type='text/css' media='all'/>
<link rel='stylesheet' id='kirki-styles-global-css' href='https://blog.lumen.com/wp-content/themes/grandnews/modules/kirki/assets/css/kirki-styles.css' type='text/css' media='all'/>
<style id='kirki-styles-global-inline-css' type='text/css'>body,input[type="text"],input[type="email"],input[type="url"],input[type="password"],textarea,input[type="tel"]{font-family:Roboto,Helvetica,Arial,sans-serif}body{font-size:18px}h1,h2,h3,h4,h5,h6,h7,blockquote{font-family:Roboto,Helvetica,Arial,sans-serif}h1,h2,h3,h4,h5,h6,h7{font-weight:800}h1{font-size:34px}h2{font-size:30px}h3{font-size:26px}h4{font-size:22px}h5{font-size:14px}h6{font-size:13px}.header_cart_wrapper .cart_count,.post_img .post_icon_circle,.ppb_blog_half_content_slider .slides li .slider_image .post_icon_circle,#post_info_bar #post_indicator,.post_circle_thumb .post_number,.post_category_tag a,.post_category_tag span,.newsticker_label,.sk-cube-grid .sk-cube,.ppb_blog_video .one.div_wrapper .post_icon_circle,.ppb_blog_random .one_fifth_bg .content_link,.Grand_News_Category ul li .category_count,.ppb_blog_grid_with_posts .one_third.last .post_img .now_playing{background:#0075c9}.read_next_wrapper:before,.read_next_wrapper .post_content .read_next_label,.social_share_counter_number{color:#0075c9}ul.post_filter li a.selected{border-color:#0075c9}body,#gallery_lightbox h2,.slider_wrapper .gallery_image_caption h2,.post_info a{color:#000}::selection{background-color:#000}a{color:#0075c9}a:hover,a:active{color:#0075c9}h1,h2,h3,h4,h5,pre,code,tt,blockquote,.post_header h5 a,.post_header h2 a,.post_header h3 a,.post_header.grid h6 a,.post_header.fullwidth h4 a,.post_header h5 a,.newsticker li a,blockquote,.site_loading_logo_item i,.subscribe_tagline,.post_info_author a,#post_info_bar #post_info_share,#post_info_bar #post_info_comment,.readmore,.post_info_comment a,.post_info_comment,.post_info_view,.woocommerce .woocommerce-ordering select,.woocommerce #page_content_wrapper a.button,.woocommerce.columns-4 ul.products li.product a.add_to_cart_button,.woocommerce.columns-4 ul.products li.product a.add_to_cart_button:hover,.ui-accordion .ui-accordion-header a,.tabs .ui-state-active a,body.woocommerce div.product .woocommerce-tabs ul.tabs li.active a,body.woocommerce-page div.product .woocommerce-tabs ul.tabs li.active a,body.woocommerce #content div.product .woocommerce-tabs ul.tabs li.active a,body.woocommerce-page #content div.product .woocommerce-tabs ul.tabs li.active a,.woocommerce div.product .woocommerce-tabs ul.tabs li a,.post_pagination a,.post_pagination a:hover,.post_pagination a:active,.post_related strong a,.pagination a,ul.post_filter li a,.read_next_wrapper .post_content .next_post_title h3 a,.author_social li a{color:#000}#social_share_wrapper, hr, #social_share_wrapper, .post.type-post, .comment .right, .widget_tag_cloud div a, .meta-tags a, .tag_cloud a, #footer, #post_more_wrapper, #page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, #autocomplete, #nav_wrapper, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle:before, .top_bar.scroll, .read_next_wrapper, #menu_wrapper .nav ul li.catmenu > .catmenu_wrapper, #menu_wrapper div .nav li.catmenu > .catmenu_wrapper, , .woocommerce ul.products li.product, .woocommerce-page ul.products li.product, .woocommerce ul.products li.product .price, .woocommerce-page ul.products li.product .price, #page_content_wrapper .inner .sidebar_content, #page_content_wrapper .inner .sidebar_content.left_sidebar, .ajax_close, .ajax_next, .ajax_prev, .portfolio_next, .portfolio_prev, .portfolio_next_prev_wrapper.video .portfolio_prev, .portfolio_next_prev_wrapper.video .portfolio_next, .separated, .blog_next_prev_wrapper, #post_more_wrapper h5, #ajax_portfolio_wrapper.hidding, #ajax_portfolio_wrapper.visible, .tabs.vertical .ui-tabs-panel, .woocommerce div.product .woocommerce-tabs ul.tabs li, .woocommerce #content div.product .woocommerce-tabs ul.tabs li, .woocommerce-page div.product .woocommerce-tabs ul.tabs li, .woocommerce-page #content div.product .woocommerce-tabs ul.tabs li, .woocommerce div.product .woocommerce-tabs .panel, .woocommerce-page div.product .woocommerce-tabs .panel, .woocommerce #content div.product .woocommerce-tabs .panel, .woocommerce-page #content div.product .woocommerce-tabs .panel, .woocommerce table.shop_table, .woocommerce-page table.shop_table, table tr td, .woocommerce .cart-collaterals .cart_totals, .woocommerce-page .cart-collaterals .cart_totals, .woocommerce .cart-collaterals .shipping_calculator, .woocommerce-page .cart-collaterals .shipping_calculator, .woocommerce .cart-collaterals .cart_totals tr td, .woocommerce .cart-collaterals .cart_totals tr th, .woocommerce-page .cart-collaterals .cart_totals tr td, .woocommerce-page .cart-collaterals .cart_totals tr th, table tr th, .woocommerce #payment, .woocommerce-page #payment, .woocommerce #payment ul.payment_methods li, .woocommerce-page #payment ul.payment_methods li, .woocommerce #payment div.form-row, .woocommerce-page #payment div.form-row, .ui-tabs li:first-child, .ui-tabs .ui-tabs-nav li, .ui-tabs.vertical .ui-tabs-nav li, .ui-tabs.vertical.right .ui-tabs-nav li.ui-state-active, .ui-tabs.vertical .ui-tabs-nav li:last-child, #page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .pricing_wrapper, .pricing_wrapper li, .ui-accordion .ui-accordion-header, .ui-accordion .ui-accordion-content, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle:before, h2.widgettitle:before, #autocomplete, .ppb_blog_minimal .one_third_bg, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle, h2.widgettitle, h5.event_title, .tabs .ui-tabs-panel, .ui-tabs .ui-tabs-nav li, .ui-tabs li:first-child, .ui-tabs.vertical .ui-tabs-nav li:last-child, .woocommerce .woocommerce-ordering select, .woocommerce div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page div.product .woocommerce-tabs ul.tabs li.active, .woocommerce #content div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page #content div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page table.cart th, table.shop_table thead tr th, #page_caption, #nav_wrapper, .header_style_wrapper .top_bar{border-color:#eee}input[type="text"],input[type="password"],input[type="email"],input[type="url"],textarea,input[type="tel"]{background-color:#fff;color:#111;border-color:#e1e1e1}input[type="text"]:focus,input[type="password"]:focus,input[type="email"]:focus,input[type="url"]:focus,textarea:focus,input[type="tel"]:focus{border-color:#000}input[type="submit"],input[type="button"],a.button,.button,.woocommerce .page_slider a.button,a.button.fullwidth,.woocommerce-page div.product form.cart .button,.woocommerce #respond input#submit.alt,.woocommerce a.button.alt,.woocommerce button.button.alt,.woocommerce input.button.alt{font-family:Roboto,Helvetica,Arial,sans-serif}input[type="submit"],input[type="button"],a.button,.button,.woocommerce .footer_bar .button,.woocommerce .footer_bar .button:hover,.woocommerce-page div.product form.cart .button,.woocommerce #respond input#submit.alt,.woocommerce a.button.alt,.woocommerce button.button.alt,.woocommerce input.button.alt{background-color:#0075c9;color:#fff;border-color:#0075c9}.frame_top,.frame_bottom,.frame_left,.frame_right{background:#222}#menu_wrapper .nav ul li a,#menu_wrapper div .nav li>a{font-family:Raleway,Helvetica,Arial,sans-serif;font-size:14px;letter-spacing:0;text-transform:none}#menu_wrapper .nav ul li a,#menu_wrapper div .nav li>a,.mobile_main_nav li a,#sub_menu li a{font-weight:700}#menu_wrapper .nav ul li a,#menu_wrapper div .nav li>a,.header_cart_wrapper a,#search_icon,#page_share{color:#111}#mobile_nav_icon{border-color:#111}#menu_wrapper .nav ul li a.hover,#menu_wrapper .nav ul li a:hover,#menu_wrapper div .nav li a.hover,#menu_wrapper div .nav li a:hover,#menu_wrapper div .nav>li.current-menu-item>a,#menu_wrapper div .nav>li.current-menu-parent>a,#menu_wrapper div .nav>li.current-menu-ancestor>a{color:#111}#menu_wrapper div .nav>li.current-menu-item>a,#menu_wrapper div .nav>li.current-menu-parent>a,#menu_wrapper div .nav>li.current-menu-ancestor>a{color:#111}.header_style_wrapper .top_bar,#nav_wrapper{border-color:#f5f5f7}#nav_wrapper,body.left_align .top_bar{background-color:#fff}#menu_wrapper .nav ul li ul li a,#menu_wrapper div .nav li ul li a,#menu_wrapper div .nav li.current-menu-parent ul li a{font-size:13px;font-weight:700;letter-spacing:0;text-transform:none;color:#111}#menu_wrapper .nav ul li ul li a:hover,#menu_wrapper div .nav li ul li a:hover,#menu_wrapper div .nav li.current-menu-parent ul li a,#menu_wrapper div .nav li.current-menu-parent ul li a:hover,#menu_wrapper .nav ul li.megamenu ul li ul li a:hover,#menu_wrapper div .nav li.megamenu ul li ul li a:hover,#menu_wrapper .nav ul li.megamenu ul li ul li a:active,#menu_wrapper div .nav li.megamenu ul li ul li a:active{color:#222}#menu_wrapper .nav ul li ul li a:hover,#menu_wrapper div .nav li ul li a:hover,#menu_wrapper div .nav li.current-menu-parent ul li a:hover,#menu_wrapper .nav ul li.megamenu ul li ul li a:hover,#menu_wrapper div .nav li.megamenu ul li ul li a:hover,#menu_wrapper .nav ul li.megamenu ul li ul li a:active,#menu_wrapper div .nav li.megamenu ul li ul li a:active{background:#f5f5f7}#menu_wrapper .nav ul li ul,#menu_wrapper div .nav li ul{background:#fff}#menu_wrapper .nav ul li ul,#menu_wrapper div .nav li ul,#menu_wrapper .nav ul li ul li a,#menu_wrapper div .nav li ul li a,#menu_wrapper div .nav li.current-menu-parent ul li a{border-color:#f5f5f7}#menu_wrapper div .nav li.megamenu ul li>a,#menu_wrapper div .nav li.megamenu ul li>a:hover,#menu_wrapper div .nav li.megamenu ul li>a:active{color:#222}#menu_wrapper div .nav li.megamenu ul li{border-color:#f5f5f7}.above_top_bar{background:#0047bb}.above_top_bar .today_time,#top_menu li a,.above_top_bar .social_wrapper ul li a,.above_top_bar .social_wrapper ul li a:hover,.above_top_bar .social_wrapper ul li a:active{color:#fff}.mobile_menu_wrapper{background-color:#fff}.mobile_main_nav li a,#sub_menu li a{font-family:Raleway,Helvetica,Arial,sans-serif;font-size:11px;text-transform:uppercase;letter-spacing:2px}.mobile_main_nav li a,#sub_menu li a,.mobile_menu_wrapper .sidebar_wrapper a,.mobile_menu_wrapper .sidebar_wrapper,#close_mobile_menu i,.mobile_menu_wrapper .sidebar_wrapper h2.widgettitle{color:#444}#close_mobile_menu_button{background-color:#444}#page_caption,#page_caption h1 span{background-color:#fff}#page_caption{padding-top:19px;padding-bottom:20px}#page_caption h1{font-size:48px}#page_caption h1,.post_caption h1{font-weight:800;text-transform:none;letter-spacing:0;color:#0075c9}#page_caption .page_title_wrapper,.page_title_wrapper{text-align:left}#page_caption.hasbg{height:60vh}.page_tagline{color:#0075c9;font-size:11px;font-weight:400;letter-spacing:2px;text-transform:none}#page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle,h2.widgettitle,h5.widgettitle,.single_subtitle{font-family:Roboto,Helvetica,Arial,sans-serif;font-size:16px;font-weight:900;letter-spacing:0;text-transform:none}#page_content_wrapper .inner .sidebar_wrapper .sidebar .content,.page_content_wrapper .inner .sidebar_wrapper .sidebar .content{color:#000}#page_content_wrapper .inner .sidebar_wrapper a,.page_content_wrapper .inner .sidebar_wrapper a{color:#111}#page_content_wrapper .inner .sidebar_wrapper a:hover,#page_content_wrapper .inner .sidebar_wrapper a:active,.page_content_wrapper .inner .sidebar_wrapper a:hover,.page_content_wrapper .inner .sidebar_wrapper a:active{color:#0075c9}#page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle,h2.widgettitle,h5.widgettitle{color:#0075c9}#footer_mailchimp_subscription{background-color:#f5f5f7}.footer_bar{background-color:#f5f5f7}#footer,#copyright{color:#000}#copyright a,#copyright a:active,#footer a,#footer a:active,#footer .sidebar_widget li h2.widgettitle{color:#000}#copyright a:hover,#footer a:hover,.social_wrapper ul li a:hover{color:#000}.footer_bar_wrapper,.footer_bar{border-color:#333}#footer .widget_tag_cloud div a{background:#333}.footer_bar_wrapper .social_wrapper ul li a{color:#000}#page_content_wrapper .inner .sidebar_content.full_width.blog_f,body.single-post #page_content_wrapper .inner .sidebar_content.full_width{width:90%}.post_header:not(.single) h5, body.single-post .post_header_title h1, #post_featured_slider li .slider_image .slide_post h2, #autocomplete li strong, .post_related strong, #footer ul.sidebar_widget .posts.blog li a, #post_info_bar .post_info .post_info_title, .post_header h2, .newsticker li a, .ppb_blog_fullwidth_slider ul.slides li .slider_image .slider_post_title h2, #menu_wrapper div .nav li.catmenu2 > .catmenu_wrapper .one_third h6, .catmenu_wrapper .one_fifth h6, #autocomplete a h6, #page_content_wrapper .posts.blog li a, .page_content_wrapper .posts.blog li a, #menu_wrapper div .nav li.catmenu2 > .catmenu_wrapper a.post_title{font-family:Roboto,Helvetica,Arial,sans-serif;text-transform:capitalize;font-weight:700;letter-spacing:0}</style>
<link rel='stylesheet' id='grandnews-script-responsive-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/grid.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-custom-menu-responsive-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/menu/left-align-grid.css' type='text/css' media='all'/>
<link rel='stylesheet' id='grandnews-script-custom-css-css' href='https://blog.lumen.com/wp-admin/admin-ajax.php?action=grandnews_custom_css' type='text/css' media='all'/>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js.pagespeed.jm.KGfnHKlMB5.js' id='monsterinsights-frontend-script-js'></script>
<script data-cfasync="false" data-wpfc-render="false" type="text/javascript" id='monsterinsights-frontend-script-js-extra'>//<![CDATA[
var monsterinsights_frontend={"js_events_tracking":"true","download_extensions":"doc,pdf,ppt,zip,xls,docx,pptx,xlsx","inbound_paths":"[{\"path\":\"\\\/go\\\/\",\"label\":\"affiliate\"},{\"path\":\"\\\/recommend\\\/\",\"label\":\"affiliate\"}]","home_url":"https:\/\/blog.lumen.com","hash_tracking":"false","ua":"UA-41153014-24","v4_id":""};
//]]></script>
<script type='text/javascript' id='addtoany-core-js-before'>window.a2a_config=window.a2a_config||{};a2a_config.callbacks=[];a2a_config.overlays=[];a2a_config.templates={};</script>
<script type='text/javascript' async src='https://static.addtoany.com/menu/page.js' id='addtoany-core-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/jquery.min.js.pagespeed.jm.izqK4d2SK0.js' id='jquery-core-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/jquery-migrate.min.js.pagespeed.jm.Ws-UgblvVg.js' id='jquery-migrate-js'></script>
<script type='text/javascript' async src='https://blog.lumen.com/wp-content/plugins/add-to-any/addtoany.min.js' id='addtoany-jquery-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js' id='ppress-flatpickr-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js.pagespeed.jm.2pngz7Q9gy.js' id='ppress-select2-js'></script>
<link rel="https://api.w.org/" href="https://blog.lumen.com/wp-json/"/><link rel="alternate" type="application/json" href="https://blog.lumen.com/wp-json/wp/v2/posts/14262"/><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://blog.lumen.com/xmlrpc.php?rsd"/>
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://blog.lumen.com/wp-includes/wlwmanifest.xml"/> 
<meta name="generator" content="WordPress 6.0.2"/>
<link rel='shortlink' href='https://blog.lumen.com/?p=14262'/>
<link rel="alternate" type="application/json+oembed" href="https://blog.lumen.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F"/>
<link rel="alternate" type="text/xml+oembed" href="https://blog.lumen.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&#038;format=xml"/>
<meta name="generator" content="Site Kit by Google 1.83.0"/>		<style>div#onetrust-consent-sdk #onetrust-banner-sdk{background-color:#f2f2f2;border:#ddd solid 1px}div#onetrust-consent-sdk #onetrust-pc-btn-handler.cookie-setting-link{color:#fff;background-color:#666;text-decoration:none}div#onetrust-consent-sdk #onetrust-pc-sdk,div#onetrust-consent-sdk #search-container,div#onetrust-consent-sdk #onetrust-pc-sdk .ot-switch.toggle,div#onetrust-consent-sdk #onetrust-pc-sdk .group-toggle .checkbox,div#onetrust-consent-sdk #onetrust-pc-sdk #pc-title:after{background-color:#fdfdfd}div#onetrust-pc-sdk .host-option-group .vendor-host{border:#ddd solid 1px}</style>
		<!-- OneTrust Cookies Consent Notice start -->
		<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8" data-domain-script="e733a0d8-63ff-4a39-b870-9ef50b603bcf"></script>
		<script type="text/javascript">function OptanonWrapper(){}</script>
		<!-- OneTrust Cookies Consent Notice end -->
		
<!-- Google Tag Manager snippet added by Site Kit -->
<script type="text/javascript">(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-TLWF636');</script>

<!-- End Google Tag Manager snippet added by Site Kit -->
<link rel="icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" sizes="32x32"/>
<link rel="icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" sizes="192x192"/>
<link rel="apple-touch-icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png"/>
<meta name="msapplication-TileImage" content="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png"/>
		<style type="text/css" id="wp-custom-css">#field_1_1 input::placeholder{font-style:normal}#field_1_1 input{text-align:center}.ppb_blog_fullwidth_slider .flex-direction-nav a{opacity:1}#wrapper{padding-top:163px}.ppb_wrapper .withsmallpadding p{padding:0}.ppb_wrapper .withsmallpadding p img{float:left;width:100%}.ppb_blog_fullwidth_slider .standard_wrapper{background:rgba(0,0,0,.3);padding:20px}.home .ppb_blog_filterable_3cols.one.nopadding{background:#f9f9fa!important}.single_subtitle{color:#0075c9!important}.home .ppb_blog_filterable_3cols.one.nopadding .single_subtitle{color:#000!important}#searchform .post_attribute{display:none}.flex-direction-nav a:before{font-size:24px;color:#ff9e18;font-weight:bolder}.flex-direction-nav a{border:3px solid #ff9e18}.fa-bolt:before{display:none}.post_info_date{color:#bebebe!important;text-transform:capitalize}.post_info_date a{color:#bebebe!important;text-transform:capitalize}input[type="submit"],input[type="button"],a.button,.button{text-transform:capitalize}.social_share_button_wrapper ul li a.google_share{display:none}ul.post_filter li a{text-transform:capitalize;font-size:16px;font-weight:500}.newsticker_label{text-transform:capitalize}.post_category_tag a,.post_category_tag span{text-transform:capitalize}#about_the_author{background:#eee}.newsticker_nav a,.carousel_nav a{border:2px solid #0075c9;opacity:1}.newsticker_nav a:before,.carousel_nav a:before{color:#0075c9}@media only screen and (max-width:768px){p{font-size:16px}}@media only screen and (max-width:320px){p{font-size:16px}}@media only screen and (max-width:960px){p{font-size:16px}}.social_share_button_wrapper{display:none}.social_share_counter{display:none}#footer_menu{display:none}#footer .sidebar_widget li h2.widgettitle{margin-bottom:25px;color:#000;text-align:center}.post_info_comment{display:none}.tg_social_icons{color:#0075c9}</style>
		<script src="//assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js" async></script>
</head>

<body class="post-template-default single single-post postid-14262 single-format-standard left_align">

		<input type="hidden" id="pp_enable_right_click" name="pp_enable_right_click" value=""/>
	<input type="hidden" id="pp_enable_dragging" name="pp_enable_dragging" value=""/>
	<input type="hidden" id="pp_image_path" name="pp_image_path" value="https://blog.lumen.com/wp-content/themes/grandnews/images/"/>
	<input type="hidden" id="pp_homepage_url" name="pp_homepage_url" value="https://blog.lumen.com/"/>
	<input type="hidden" id="pp_ajax_search" name="pp_ajax_search" value="1"/>
	<input type="hidden" id="pp_fixed_menu" name="pp_fixed_menu" value="1"/>
	<input type="hidden" id="tg_sidebar_sticky" name="tg_sidebar_sticky" value="1"/>
	<input type="hidden" id="pp_topbar" name="pp_topbar" value=""/>
	<input type="hidden" id="pp_page_title_img_blur" name="pp_page_title_img_blur" value="1"/>
	<input type="hidden" id="tg_blog_slider_layout" name="tg_blog_slider_layout" value=""/>
	<input type="hidden" id="pp_back" name="pp_back" value="Back"/>
	<input type="hidden" id="tg_lightbox_skin" name="tg_lightbox_skin" value="metro-black"/>
	<input type="hidden" id="tg_lightbox_thumbnails" name="tg_lightbox_thumbnails" value="horizontal"/>
	<input type="hidden" id="tg_lightbox_opacity" name="tg_lightbox_opacity" value="0.95"/>
	<input type="hidden" id="tg_enable_lazy" name="tg_enable_lazy" value=""/>
	
		<input type="hidden" id="pp_footer_style" name="pp_footer_style" value="2"/>
	
	<!-- Begin mobile menu -->
	<a id="close_mobile_menu" href="javascript:;"></a>
	<div class="mobile_menu_wrapper">
		<a id="close_mobile_menu_button" href="javascript:;"><i class="fa fa-close"></i></a>
	
	    <div class="menu-main-menu-container"><ul id="mobile_main_menu" class="mobile_main_nav"><li id="menu-item-4996" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-4996"><a href="https://blog.lumen.com/technologies/">Technologies</a>
<ul class="sub-menu">
	<li id="menu-item-6828" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6828"><a href="https://blog.lumen.com/black-lotus-labs/">Black Lotus Labs</a></li>
	<li id="menu-item-4942" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4942"><a href="https://blog.lumen.com/technologies/cloud/">Cloud</a></li>
	<li id="menu-item-11229" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11229"><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Compute</a></li>
	<li id="menu-item-5014" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5014"><a href="https://blog.lumen.com/technologies/collaboration/">Collaboration</a></li>
	<li id="menu-item-5027" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5027"><a href="https://blog.lumen.com/technologies/managed-services/">Managed Services</a></li>
	<li id="menu-item-5036" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5036"><a href="https://blog.lumen.com/technologies/network/">Network</a></li>
	<li id="menu-item-4963" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4963"><a href="https://blog.lumen.com/technologies/security/">Security</a></li>
</ul>
</li>
<li id="menu-item-5039" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5039"><a href="https://blog.lumen.com/business-advice/">Business Advice</a>
<ul class="sub-menu">
	<li id="menu-item-11240" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11240"><a href="https://blog.lumen.com/4th-industrial-revolution/">4th Industrial Revolution</a></li>
	<li id="menu-item-5092" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://blog.lumen.com/business-advice/business-continuity-disaster-recovery/">Business Continuity &#038; Disaster Recovery</a></li>
	<li id="menu-item-5063" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5063"><a href="https://blog.lumen.com/business-advice/customer-experience/">Customer Experience</a></li>
	<li id="menu-item-5061" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5061"><a href="https://blog.lumen.com/business-advice/data-driven-business/">Data Driven Business</a></li>
	<li id="menu-item-4882" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4882"><a href="https://blog.lumen.com/business-advice/operational-efficiency/">Operational Efficiency</a></li>
	<li id="menu-item-5049" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5049"><a href="https://blog.lumen.com/business-advice/tech-trends/">Tech Trends</a></li>
</ul>
</li>
<li id="menu-item-5183" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5183"><a href="https://blog.lumen.com/industries/">Industries</a>
<ul class="sub-menu">
	<li id="menu-item-5100" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5100"><a href="https://blog.lumen.com/industries/financial-services/">Financial Services</a></li>
	<li id="menu-item-5120" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5120"><a href="https://blog.lumen.com/industries/healthcare/">Healthcare</a></li>
	<li id="menu-item-8761" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8761"><a href="https://blog.lumen.com/industries/gaming/">Gaming</a></li>
	<li id="menu-item-5137" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5137"><a href="https://blog.lumen.com/industries/manufacturing/">Manufacturing</a></li>
	<li id="menu-item-5147" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5147"><a href="https://blog.lumen.com/industries/media-and-entertainment/">Media and Entertainment</a></li>
	<li id="menu-item-8806" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8806"><a href="https://blog.lumen.com/industries/pharmaceutical/">Pharmaceutical</a></li>
	<li id="menu-item-5162" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5162"><a href="https://blog.lumen.com/industries/public-sector/">Public Sector</a></li>
	<li id="menu-item-5177" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5177"><a href="https://blog.lumen.com/industries/retail/">Retail</a></li>
	<li id="menu-item-11816" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11816"><a href="https://blog.lumen.com/industries/technology/">Technology</a></li>
</ul>
</li>
<li id="menu-item-6838" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-6838"><a href="https://blog.lumen.com/about-lumen/">About Us</a>
<ul class="sub-menu">
	<li id="menu-item-6851" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6851"><a href="https://blog.lumen.com/leadership-perspectives/">Leadership Perspectives</a></li>
	<li id="menu-item-4743" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-4743"><a target="_blank" rel="noopener" href="https://news.lumen.com">NewsRoom</a></li>
</ul>
</li>
</ul></div>		
		<!-- Begin side menu sidebar -->
		<div class="page_content_wrapper">
			<div class="sidebar_wrapper">
		        <div class="sidebar">
		        
		        	<div class="content">
		        
		        		<ul class="sidebar_widget">
		        				        		</ul>
		        	
		        	</div>
		    
		        </div>
			</div>
		</div>
		<!-- End side menu sidebar -->
	</div>
	<!-- End mobile menu -->

	<!-- Begin template wrapper -->
	<div id="wrapper">
	
	
<div class="header_style_wrapper">



<div class="top_bar">
    
    <div class="standard_wrapper">
    
	    <!-- Begin logo -->
	    <div id="logo_wrapper">
	    
	    	    <div id="logo_normal" class="logo_container">
	        <div class="logo_align">
		        <a id="custom_logo" class="logo_wrapper default" href="https://blog.lumen.com/">
		        			    		<img src="https://blog.lumen.com/wp-content/uploads/2020/09/Lumen-Logo.png" alt="" width="215" height="64"/>
		    				        </a>
	        </div>
	    </div>
	    	    <!-- End logo -->
	    
	    
	    <div id="menu_wrapper">
	    
	    <!-- Begin right corner buttons -->
		<div id="logo_right_button">
		    <!-- div class="post_share_wrapper">
		    	<a id="page_share" href="javascript:;"><i class="fa fa-share-alt"></i></a>
		    </div -->
		    
		    		    
		    <!-- Begin search icon -->
		    <a href="javascript:;" id="search_icon"><i class="fa fa-search"></i></a>
		    <!-- End side menu -->
		
		    <!-- Begin search icon -->
		    <a href="javascript:;" id="mobile_nav_icon"></a>
		    <!-- End side menu -->
		    
		</div>
		<!-- End right corner buttons -->
	    
			      <div id="nav_wrapper">
	      	<div class="nav_wrapper_inner">
	      		<div id="menu_border_wrapper">
	      			<div class="menu-main-menu-container"><ul id="main_menu" class="nav"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-4996"><a href="https://blog.lumen.com/technologies/">Technologies</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6828"><a href="https://blog.lumen.com/black-lotus-labs/">Black Lotus Labs</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4942"><a href="https://blog.lumen.com/technologies/cloud/">Cloud</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11229"><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Compute</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5014"><a href="https://blog.lumen.com/technologies/collaboration/">Collaboration</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5027"><a href="https://blog.lumen.com/technologies/managed-services/">Managed Services</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5036"><a href="https://blog.lumen.com/technologies/network/">Network</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4963"><a href="https://blog.lumen.com/technologies/security/">Security</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-5039"><a href="https://blog.lumen.com/business-advice/">Business Advice</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11240"><a href="https://blog.lumen.com/4th-industrial-revolution/">4th Industrial Revolution</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://blog.lumen.com/business-advice/business-continuity-disaster-recovery/">Business Continuity &#038; Disaster Recovery</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5063"><a href="https://blog.lumen.com/business-advice/customer-experience/">Customer Experience</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5061"><a href="https://blog.lumen.com/business-advice/data-driven-business/">Data Driven Business</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4882"><a href="https://blog.lumen.com/business-advice/operational-efficiency/">Operational Efficiency</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5049"><a href="https://blog.lumen.com/business-advice/tech-trends/">Tech Trends</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-5183"><a href="https://blog.lumen.com/industries/">Industries</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5100"><a href="https://blog.lumen.com/industries/financial-services/">Financial Services</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5120"><a href="https://blog.lumen.com/industries/healthcare/">Healthcare</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8761"><a href="https://blog.lumen.com/industries/gaming/">Gaming</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5137"><a href="https://blog.lumen.com/industries/manufacturing/">Manufacturing</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5147"><a href="https://blog.lumen.com/industries/media-and-entertainment/">Media and Entertainment</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8806"><a href="https://blog.lumen.com/industries/pharmaceutical/">Pharmaceutical</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5162"><a href="https://blog.lumen.com/industries/public-sector/">Public Sector</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5177"><a href="https://blog.lumen.com/industries/retail/">Retail</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11816"><a href="https://blog.lumen.com/industries/technology/">Technology</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-6838"><a href="https://blog.lumen.com/about-lumen/">About Us</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6851"><a href="https://blog.lumen.com/leadership-perspectives/">Leadership Perspectives</a></li>
	<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-4743"><a target="_blank" rel="noopener" href="https://news.lumen.com">NewsRoom</a></li>
</ul>
</li>
</ul></div>	      		</div>
	      	</div>
	      </div>
	      <!-- End main nav -->
	  	  
  	</div>
</div>
</div>
</div>
</div>



<!-- Begin content -->
<div id="page_content_wrapper" class="">
<div class="inner">

	<!-- Begin main content -->
	<div class="inner_wrapper">

		<div class="sidebar_content">
					
						
<!-- Begin each blog post -->
<div id="post-14262" class="post-14262 post type-post status-publish format-standard has-post-thumbnail hentry category-about-lumen category-black-lotus-labs category-security category-technologies tag-black-lotus-labs tag-connected-security">

	<div class="post_wrapper">
	    
	    <div class="post_content_wrapper">
	    
	    		    
	    	<div class="post_header">
				<div class="post_header_title">
				 	<div class="post_info_cat">
				 						 	</div>
				   	<h1>Chaos is a Go-based Swiss army knife of malware</h1>
				   	<div class="post_detail post_date">
			      		<span class="post_info_author">
			      						      			<a href="https://blog.lumen.com/author/black-lotus-labs/"><span class="gravatar"><img data-del="avatar" src='https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-65x65.png' class='avatar pp-user-avatar avatar-60 photo ' height='60' width='60'/></span>Black Lotus Labs</a>
			      		</span>
			      		<span class="post_info_date">
			      			Posted On September 28, 2022			      		</span>
				  	</div>
				  	<div class="post_detail post_comment">
				  		<div class="post_info_comment">
							<a href="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/#respond"><i class="fa fa-commenting"></i>0</a>
						</div>
						
										  	</div>
				</div>
			</div>
			
			<hr class="post_divider"/><br class="clear"/>
			
						
			<div class="social_share_counter">
	<div class="social_share_counter_number">0</div>
	<div class="social_share_counter_label">Shares</div>
</div>
<div class="social_share_button_wrapper">
	<ul>
		<li><a class="tooltip facebook_share" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-facebook"></i>Share On Facebook</a></li>
		<li><a class="tooltip twitter_share" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/&text=Chaos is a Go-based Swiss army knife of malware&url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-twitter"></i>Tweet It</a></li>
		<li><a class="tooltip pinterest_share" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2022%2F09%2Fmalware.jpg"><i class="fa fa-pinterest"></i></a></li>
		<li><a class="tooltip google_share" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-google-plus"></i></a></li>
		<li><a class="tooltip email_share" title="Share by Email" href="mailto:?Subject=Chaos+is+a+Go-based+Swiss+army+knife+of+malware&amp;Body=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F"><i class="fa fa-envelope"></i></a></li>
	</ul>
</div>
<Br class="clear"/>	    
	    				
			    	    <div class="post_img static">
			    	    	<img src="https://blog.lumen.com/wp-content/uploads/2022/09/malware.jpg" alt="World map with red target on Europe and points on other cities" class="" style="width:848px;height:566px;"/>
			    	    </div>
			
			
		    <div class="post_header single">
				
				<div class="addtoany_share_save_container addtoany_content addtoany_content_top"><div class="a2a_kit a2a_kit_size_32 addtoany_list" data-a2a-url="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/" data-a2a-title="Chaos is a Go-based Swiss army knife of malware"><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&amp;linkname=Chaos%20is%20a%20Go-based%20Swiss%20army%20knife%20of%20malware" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&amp;linkname=Chaos%20is%20a%20Go-based%20Swiss%20army%20knife%20of%20malware" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&amp;linkname=Chaos%20is%20a%20Go-based%20Swiss%20army%20knife%20of%20malware" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_pinterest" href="https://www.addtoany.com/add_to/pinterest?linkurl=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&amp;linkname=Chaos%20is%20a%20Go-based%20Swiss%20army%20knife%20of%20malware" title="Pinterest" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&amp;linkname=Chaos%20is%20a%20Go-based%20Swiss%20army%20knife%20of%20malware" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><h2>Executive Summary</h2>
<p>The prevalence of malware written in Go programming language has increased dramatically in recent years due to its flexibility, low antivirus detection rates and difficulty to reverse-engineer. Black Lotus Labs, the threat intelligence arm of Lumen Technologies, recently uncovered a multifunctional Go-based malware that was developed for both Windows and Linux, as well as a wide array of software architectures used in devices ranging from small office/home office (SOHO) routers to enterprise servers. We discovered and analyzed roughly 100 samples of the malware, named Chaos by the actor, which was written in Chinese and leverages China-based infrastructure for command and control. Chaos functionality includes the ability to enumerate the host environment, run remote shell commands, load additional modules, automatically propagate through stealing and brute forcing SSH private keys, as well as launch DDoS attacks. Using Lumen global network visibility, Black Lotus Labs enumerated the C2s and targets of several distinct Chaos clusters, including a successful compromise of a GitLab server and a spate of recent DDoS attacks targeting the gaming, financial services and technology, and media and entertainment industries – as well as DDoS-as-a-service providers and a cryptocurrency exchange. While the botnet infrastructure today is comparatively smaller than some of the leading DDoS malware families, Chaos has demonstrated rapid growth in the last few months. Given the suitability of the Chaos malware to operate across a range of consumer and enterprise devices, its multipurpose functionality and the stealth profile of the network infrastructure behind it, we assess with moderate confidence this activity is the work of a cybercriminal actor that is cultivating a network of infected devices to leverage for initial access, DDoS attacks and crypto mining.</p>
<h2>Introduction</h2>
<p>The potency of the Chaos malware stems from a few factors: first, it is designed to work across several architectures, including: ARM, Intel (i386), MIPS and PowerPC – in addition to both Windows and Linux operating systems. Second, unlike largescale ransomware distribution botnets like <a href="https://blog.lumen.com/emotet-redux/?utm_source=referral&amp;utm_medium=black+lotus+labs+page" target="_blank" rel="noopener">Emotet</a> that leverage spam to spread and grow, Chaos propagates through known CVEs and brute forced as well as stolen SSH keys.</p>
<p>In the course of our analysis, we frequently observed source file names incorporating “Chaos” as well as references to Chaos in various function names, and self-signed X.509 certificates. We assess, based on code and function overlap, Chaos is the evolution of the DDoS malware <a href="https://malpedia.caad.fkie.fraunhofer.de/details/elf.kaiji" target="_blank" rel="noopener">Kaiji</a>. At this point in time, we also assess this campaign is distinct from the Chaos ransomware builder which was previously referenced <a href="https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html" target="_blank" rel="noopener">here</a>.</p>
<h3>Technical Details</h3>
<p style="text-align: center;"><img class="aligncenter size-full wp-image-14268" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure1_InfectionProcess.png" alt="Chaos infection chain" width="1062" height="395"/><span style="font-size: 10pt;">Figure 1: Chaos infection chain</span></p>
<p>At a high level, the Chaos infection chain can be summarized as follows: Chaos is installed on a host device, establishes persistence and beacons out to the embedded C2. The host then receives one or more staging commands depending on the sample and the host environment: these include commands to initialize propagation through exploiting a known CVE, to automatically propagate through SSH via brute-forcing or leveraging stolen SSH keys and to begin IP spoofing. Based on the first set of commands, the host may receive a number of additional execution commands including performing propagation via the designated CVE and specified target lists, further exploitation of the current target, launching a specific type of DDoS attack against a specified domain or IP and port, and performing crypto mining.</p>
<h2>Staging Commands</h2>
<p>Because we first discovered Chaos through analyzing samples from a public malware repository, we have not yet ascertained the initial access vector. However, we determined that once on an infected Windows device, Chaos creates a mutex by binding to a UDP port that is determined by the first few digits of the device’s MAC address, ignoring leading zeros. For example, with the MAC address 08-00-2x-xx-xx-xx, the port becomes 0x8002 or 32770. This method of converting to hex obscures the port from being readily discernible in the code, perhaps to shield it from analysis. If the sample is unsuccessful at binding to the port, then the program exits, likely to ensure that only one instance of the malware runs concurrently on the infected machine.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14269" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure2_MethodBind.png" alt="Method that generates host port " width="726" height="990"/><span style="font-size: 10pt;">Figure 2: Method that generates the host port to bind to in a Windows device</span></p>
<p>In its first outreach to the C2, Chaos decodes the Base64-encoded C2 and port combination and sends a beacon that includes the word “online,” the Windows version and the architecture of the host. Next, it creates a registry key for persistence at the following path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and copies itself to the file \Program Data\Microsoft\csrss.exe. It then adds to the newly created registry key under the name “Administrator” and attempts to complete a TLS handshake with the C2. The handshake process loops until it makes contact, at which point it gathers additional information about the infected host. If the Windows version fails, the string “windwos 未知“ is sent in its place. (Note the typo in “windows.” The Chinese characters translate to “unknown.”)</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14270" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure3_WindowsStrings.png" alt="Snapshot of strings" width="318" height="90"/><span style="font-size: 10pt;">Figure 3: Snapshot of strings for different Windows versions</span></p>
<p>Once an infected machine establishes a socket with the hardcoded C2, the C2 responds with a set of staging commands, including initialization commands and commands to trigger automatic propagation via SSH.</p>
<p>The staging commands consist of <span style="font-family: 'courier new', courier, monospace;">fileprot</span>, <span style="font-family: 'courier new', courier, monospace;">keypassword</span> and <span style="font-family: 'courier new', courier, monospace;">ipspoof</span>. First, the <span style="font-family: 'courier new', courier, monospace;">fileprot</span> command sets a new port for accessing additional files on the C2 that are used by other commands: password.txt, download.sh and cve.txt. The <span style="font-family: 'courier new', courier, monospace;">keypassword</span> provides the AES password and initialization vector needed to decrypt the three additional files. The password was commonly set as “1234567812345678.”</p>
<p>The <span style="font-family: 'courier new', courier, monospace;">keypassword</span> function also calls two functions used in compromising additional machines through SSH by using keys stolen from the infected host, brute force or via the downloaded password.txt file: <span style="font-family: 'courier new', courier, monospace;">chaos.ssh</span> and <span style="font-family: 'courier new', courier, monospace;">chaos.sshboom</span>. The <span style="font-family: 'courier new', courier, monospace;">chaos.ssh</span> function reads the private key from /root/.ssh/id_rsa and then parses /root/.ssh/known_hosts and /root/.bash_history for the IP address of any lateral device. If it finds an IP, it tries to connect to the new address using the SSH key. If successful, it assesses whether the new device is a Linux system by running <span style="font-family: 'courier new', courier, monospace;">uname –s</span>, making the response all uppercase and searching for ‘LINUX.’ If ‘LINUX’ is not found, it closes the connection. If ‘LINUX’ is found, it then downloads the download.txt file from the IP:port location set by the <span style="font-family: 'courier new', courier, monospace;">fileport</span> command.</p>
<p>The <span style="font-family: 'courier new', courier, monospace;">chaos.sshboom</span> function is similar to the <span style="font-family: 'courier new', courier, monospace;">chaos.ssh</span> function, except it downloads http://IP:PORT/passwords.txt and decrypts it, similar to the <span style="font-family: 'courier new', courier, monospace;">runcve</span> command, using AES Cipher Block Chaining with information supplied by the <span style="font-family: 'courier new', courier, monospace;">keypassword</span> command. The password file contains commonly used passwords used to brute force other devices exposed on the internet.</p>
<p>If either the SSH stealing or brute-forcing attempts are successful, the download file is triggered. The download file contains the IP address and port of a staging server that hosts copies of Chaos compiled for various architectures, such as x86, x86-64, AMD64, MIPS, MIPS64, ARMv5-ARMv8, AArch64 and PowerPC. Chaos uses the staging server not to control the bots, but to iterate through the infection process outlined above in an effort to further propagate the botnet.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14271" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure4_DownloadBash.png" alt="Snippet from download.sh bash script " width="1536" height="378"/><span style="font-size: 10pt;">Figure 4: Snippet from the download.sh bash script showing Chaos modules for various architectures</span></p>
<h2>Execution Commands and Additional Modules</h2>
<p>We observed that, after receiving the initial set of commands from the C2, bots would sporadically receive additional commands that included executing propagation through exploitation of pre-determined CVEs on target ranges, further exploiting the current target, launching DDoS attacks or initiating crypto mining. Over the course of a few days, one bot received more than 70 different commands.</p>
<p>The command to activate CVE exploitation is called <span style="font-family: 'courier new', courier, monospace;">runcve</span>. In the command, <span style="font-family: 'courier new', courier, monospace;">runcve</span> includes an IP supplied by the C2 that iterates upwards by a single digit in an attempt to move laterally by exploiting the CVE defined in the cve.txt file. Among the samples we analyzed were reported CVEs for Huawei (<a href="https://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en" target="_blank" rel="noopener">CVE-2017-17215</a>) and Zyxel (<a href="https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/" target="_blank" rel="noopener">CVE-2022-30525</a>) personal firewalls, both of which leveraged unauthenticated remote command line injection vulnerabilities. However, the CVE file appears trivial for the actor to update, and we assess it is highly likely the actor leverages <a href="https://twitter.com/0xrb/status/1524652485327339520" target="_blank" rel="noopener">other CVEs</a>. In the example below, the two CVEs referenced do not contain any exploit code, but instead the phrase, in Chinese, “Here is the command to execute” along with a command to exploit the Zyxel CVE and a command to exploit the Huawei CVE.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14272" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure5_CVE.png" alt="recent Chaos sample" width="624" height="340"/><span style="font-size: 10pt;">Figure 5: CVE commands from a recent Chaos sample</span></p>
<p>In addition to the new functionality the Chaos malware exhibits detailed above, the malware also includes capabilities previously documented in the original Kaiji botnet: establish a reverse shell, initiate crypto mining and launch DDoS attacks.</p>
<p>The reverse shell module was an open source <a href="https://gist.github.com/paul91/60371b437658093e826e" target="_blank" rel="noopener">pearl script</a> copied from GitHub. The script was designed to run on bash shells that come natively installed on Linux systems and allows an actor to run arbitrary commands on an infected device. In Chaos, the module enables the threat actor to upload, download or modify files on an infected machine.</p>
<p>In one instance, we received a command to download the Monero cryptocurrency miner software <a href="https://github.com/xmrig/xmrig" target="_blank" rel="noopener">xmrig</a>, along with a configuration file. Once installed, the miner ran in the background and began to utilize the infected machine’s CPU to generate Monero for the threat actor using the following wallet ID: 84vmv5GjgtK9hgo1Fa2fpmDykqhphzsFwcdPmodDGJPhZK3NuVdjYvhJcZfDpu1djC256zTdGM8msF2o4xxtrXm2LXwrutT.</p>
<p>Finally, over the course of our analysis, we observed Chaos deploying the following DDoS modules: “<a href="https://blog.malwaremustdie.org/2016/01/mmd-0048-2016-ddostf-new-elf-windows.html" target="_blank" rel="noopener">ddostf</a>” and <a href="https://www.trendmicro.com/en_us/research/19/g/multistage-attack-delivers-billgates-setag-backdoor-can-turn-elasticsearch-databases-into-ddos-botnet-zombies.html" target="_blank" rel="noopener">Bill Gates/Setag</a>. The “ddostf” module, which was first reported in 2016 by MalwareMustDie, enables an actor to direct bots to perform various types of DDoS attacks against the domain or IP and port combination of its intended targets. In one instance, we observed a FreeBSD-compiled sample hosted on a staging server that we identified as being a Bill Gates/Setag sample. We suspect the threat actor may have acquired the Bill Gates DDoS malware to leverage it specifically against FreeBSD servers, which were not otherwise covered in the Chaos codebase.</p>
<h2>Differences Between Windows and Linux Versions</h2>
<p>We observed several differences between the Windows and Linux versions of the malware: how Chaos establishes persistence, how it beacons to the C2 and how it responds to the <span style="font-family: 'courier new', courier, monospace;">ipspoof</span> command.</p>
<p>Contrasted with the persistence method for Windows described above, to establish persistence in Linux, Chaos copies itself to the file path /etc/id.services.conf and creates a file /etc/32678 with the contents:</p>
<p style="padding-left: 40px;">#!/bin/sh<br/>
while [ 1 ]; do<br/>
sleep 60<br/>
/etc/id.services.conf<br/>
done.</p>
<p>The Linux version also employs a slightly different beacon than the Windows version as described above: the <span style="font-family: 'courier new', courier, monospace;">uname</span> function still gathers the operating system information, but it does not appear to send the architecture information. If the call to <span style="font-family: 'courier new', courier, monospace;">unname</span> fails, a response in Chinese is sent: 获取失败, which translates in English to “GET failed.”</p>
<p>While the Windows version ignores the <span style="font-family: 'courier new', courier, monospace;">ipspoof</span> command and likely does not implement IP spoofing functionality at this time, the Linux version uses the command to set the socket option to IP_HDRINCL to use the IP sent with the command. The <span style="font-family: 'courier new', courier, monospace;">ipspoof</span> command sets headers to an IP based on an altered version of the second octet of the bot IP: the second octet is one less than the infected IP and it is sent 30 times, subtracting one digit from the last IP each time. We assess this is meant to spoof the header during a DDoS attack to appear as if the packets are coming from a range of IPs rather than a single bot.</p>
<h2>Correlations to the Kaiji Botnet</h2>
<p>Based upon our analysis of the functions within the more than 100 samples we analyzed for this report, we assess Chaos is the next iteration of the Kaiji botnet. Kaiji was originally discovered in 2020 targeting Linux-based AMD and i386 servers by leveraging SSH brute forcing to infect new bots and then launch DDoS attacks.</p>
<p>Since the most recent <a href="https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html" target="_blank" rel="noopener">Kaiji report</a>, Chaos has evolved the original capabilities to include modules for new architectures, as well as the Windows OS. Chaos also leverages additional propagation mechanisms, including CVE exploitation and SSH key harvesting.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14273" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure6_Kaiji_Chaos.png" alt="Comparison of Kaiji and Chaos " width="377" height="480"/><span style="font-size: 10pt;">Figure 6: Comparison of select Kaiji (left) and Chaos (right) functions</span></p>
<h3>Black Lotus Labs Telemetry</h3>
<p>Once we analyzed the Chaos functions outlined above, we associated other samples with the malware and compiled a list of embedded command and control domains the bots would communicate with once infected. Using Black Lotus Labs global telemetry, we identified hundreds of unique IP addresses representing compromised Chaos bots from mid-June through mid-July – before a marked uptick in staging server C2s. While the bots were most heavily concentrated in Europe, they were distributed across the globe, with hotspots in North and South America, as well as Asia Pacific. (Note: We did not observe any bots located in Australia or New Zealand.)</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14274" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure7_ChaosBots.png" alt="Global distribution of Chaos bots" width="624" height="292"/><span style="font-size: 10pt;">Figure 7: Global distribution of Chaos bots during the snapshot from mid-June to mid-July</span></p>
<h2>Chaos Self-Signed Certificates</h2>
<p>While analyzing the IP address of a staging server hosting additional modules, we noted it had an abnormal self-signed certificate that displayed the organization name of “Chaos”.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14275" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure8_Certs.png" alt="Example of a Chaos certificate" width="480" height="251"/><span style="font-size: 10pt;">Figure 8: Example of a Chaos self-signed certificate</span></p>
<p>We then searched for IP addresses with similar self-signed certificates that contained the word “Chaos” in the organization name and discovered 15 active nodes at the time. The earliest certificate was generated on April 16, 2022; we assess this was when the Chaos activity cluster was first launched in the wild. Since then, the number of Chaos self-signed certificates has shown marked growth; the total more than doubled in May with 39 and we tallied 93 in the month of August. September has already surpassed August with 111 as of Sept. 27. We observed interactions with these servers from both embedded Linux devices as well as enterprise servers, such as one in Europe that was hosting an instance of GitLab. Like the Chaos bots depicted in the heatmap above, the majority of the entities communicating with the staging servers were located in Europe with few devices distributed globally.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter wp-image-14323 size-full" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure9_C2s_Current.png" alt="Month breakdown of new Chaos certificates" width="433" height="272"/><span style="font-size: 10pt;">Figure 9: Month by month breakdown of new Chaos certificates based on first observation in the wild</span></p>
<h2>Recent DDoS Targets</h2>
<p>Over the first few weeks of September, our Chaos host emulator received multiple DDoS commands targeting roughly two dozen organizations’ domains or IPs. Using our global telemetry, we identified multiple DDoS attacks that coincide with the timeframe, IP and port from the attack commands we received. Attack types were generally multi-vector leveraging UDP and TCP/SYN across multiple ports, often increasing in volume over the course of multiple days. Targeted entities included gaming, financial services and technology, media and entertainment, and hosting. We even observed attacks targeting DDoS-as-a-service providers and a crypto mining exchange. Collectively, the targets spanned EMEA, APAC and North America.</p>
<p>One gaming company was targeted for a mixed UDP, TCP and SYN attack over port 30120. Beginning September 1 – September 5, the organization received a flood of traffic over and above its typical volume. A breakdown of traffic for the timeframe before and through the attack period shows a flood of traffic sent to port 30120 by approximately 12K distinct IPs – though some of that traffic may be indicative of IP spoofing.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14277" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure10_Gaming_DDoS_vf.png" alt="DDoS attack volume" width="1545" height="477"/><span style="font-size: 10pt;">Figure 10: Gaming company DDoS attack volume</span></p>
<p>A few of the targets included DDoS-as-a-service providers. One markets itself as a premier IP stressor and booter that offers CAPTCHA bypass and “unique” transport layer DDoS capabilities. In mid-August, our visibility revealed a massive uptick in traffic roughly four times higher than the highest volume registered over the prior 30 days. This was followed on September 1 by an even larger spike of more than six times the normal traffic volume.</p>
<p style="text-align: center;"><img loading="lazy" class="aligncenter size-full wp-image-14278" src="https://blog.lumen.com/wp-content/uploads/2022/09/Figure11_DDoSaaS_Attack.png" alt="DDoS-as-a-service incoming attack volume" width="1477" height="459"/><span style="font-size: 10pt;">Figure 11: DDoS-as-a-service organization incoming attack volume</span></p>
<h2>Conclusion</h2>
<p>While the shift to Go-based malware has been underway for the last few years, there are few strains that demonstrate the breadth of Chaos in terms of the wide array of architectures and operating systems it was designed to infect. Not only does it target enterprise and large organizations but also devices and systems that aren’t routinely monitored as part of an enterprise security model, such as SOHO routers and FreeBSD OS. And with a significant evolution from its predecessor, Chaos is achieving rapid growth since the first documented evidence of it in the wild.<br/>
Black Lotus Labs has null-routed the Chaos C2s across the Lumen global backbone and added the IoCs from this campaign into the threat intelligence feed that fuels the Lumen Connected Security portfolio. We will continue to monitor for new infrastructure, targeting activity and expanding TTPs, as well as collaborate with the security research community to share findings related to this activity.<br/>
We encourage the community to monitor for and alert on these and any similar IoCs. We also advise the following:</p>
<ul>
<li>Network defenders: One of the main ways Chaos spreads is through exploitation of known vulnerabilities. Ensure effective patch management of newly discovered CVEs. Use the IoCs outlined in this report to monitor for a Chaos infection, as well as connections to any suspicious infrastructure.</li>
<li>Consumers with SOHO routers: Follow best practices of regularly rebooting routers and installing security updates and patches. Users should leverage properly configured and updated EDR solutions on hosts and regularly update software consistent with vendor patches where applicable.</li>
<li>Remote workers: Change default passwords and disable remote root access on machines that don’t require it. Store SSH keys securely and only on devices that require them.<br/>
We recommend that businesses consider comprehensive Secure Access Service Edge (SASE) and DDoS mitigation protections to bolster their security postures and enable robust detection on network-based communications.</li>
</ul>
<p>For additional IoCs associated with this campaign, please <a href="https://github.com/blacklotuslabs/IOCs/blob/main/Chaos_IoCs.txt" target="_blank" rel="noopener">visit our GitHub page</a>.</p>
<p>If you would like to collaborate on similar research, please contact us on Twitter @BlackLotusLabs.</p>
<p>This analysis was performed by Danny Adamitis, Steve Rudd and Stephanie Walkenshaw.</p>
<p><span style="font-size: 10pt;">This information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk.</span></p>
<div class='yarpp yarpp-related yarpp-related-website yarpp-template-list'>
<!-- YARPP List -->
<h3>Related posts:</h3><ol>
<li><a href="https://blog.lumen.com/windows-subsystem-for-linux-wsl-threats/" rel="bookmark" title="Windows Subsystem for Linux (WSL): Threats Still Lurk Below the (Sub)Surface">Windows Subsystem for Linux (WSL): Threats Still Lurk Below the (Sub)Surface </a></li>
<li><a href="https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/" rel="bookmark" title="ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks">ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks </a></li>
<li><a href="https://blog.lumen.com/ismdoor-malware-continues-to-make-use-of-dns-tunneling/" rel="bookmark" title="Ismdoor Malware Continues to Make use of DNS Tunneling">Ismdoor Malware Continues to Make use of DNS Tunneling </a></li>
<li><a href="https://blog.lumen.com/a-look-inside-the-trickbot-botnet/" rel="bookmark" title="A Look Inside The TrickBot Botnet">A Look Inside The TrickBot Botnet </a></li>
</ol>
</div>
				
				<div class="post_share_center">
				<div class="social_share_counter">
	<div class="social_share_counter_number">0</div>
	<div class="social_share_counter_label">Shares</div>
</div>
<div class="social_share_button_wrapper">
	<ul>
		<li><a class="tooltip facebook_share" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-facebook"></i>Share On Facebook</a></li>
		<li><a class="tooltip twitter_share" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/&text=Chaos is a Go-based Swiss army knife of malware&url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-twitter"></i>Tweet It</a></li>
		<li><a class="tooltip pinterest_share" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2022%2F09%2Fmalware.jpg"><i class="fa fa-pinterest"></i></a></li>
		<li><a class="tooltip google_share" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-google-plus"></i></a></li>
		<li><a class="tooltip email_share" title="Share by Email" href="mailto:?Subject=Chaos+is+a+Go-based+Swiss+army+knife+of+malware&amp;Body=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F"><i class="fa fa-envelope"></i></a></li>
	</ul>
</div>
<Br class="clear"/>				</div>
				<hr/>
				
							</div>

		    			    <div class="post_excerpt post_tag">
			    	<i class="fa fa-tags"></i>
			    	<a href="https://blog.lumen.com/tag/black-lotus-labs/" rel="tag">Black Lotus Labs</a><a href="https://blog.lumen.com/tag/connected-security/" rel="tag">Connected Security</a><br/>			    </div>
						<br class="clear"/><br/>
			
			<div id="about_the_author">
    <div class="gravatar"><img data-del="avatar" src='https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-300x300.png' class='avatar pp-user-avatar avatar-200 photo ' height='200' width='200'/></div>
    <div class="author_detail">
     	<div class="author_content">
     		<div class="author_label">Author</div>
     		<h4>Black Lotus Labs</h4>
     		The mission of Black Lotus Labs is to leverage our network visibility to help protect customers and keep the internet clean.     		
		 	<ul class="author_social">
	     				    			    			    			    			 	</ul>
     	</div>
    </div>
    <br class="clear"/>
</div>
			
							<h5 class="single_subtitle">Trending Now</h5>
			  	<div class="post_trending">
									<div class="one_half ">
							<div class="post_wrapper grid_layout">
														<div class="post_img small static">
								    <a href="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/">
								    									    	<img src="https://blog.lumen.com/wp-content/uploads/2022/09/malware-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								    </a>
								</div>
														<div class="blog_grid_content">
									<div class="post_header grid">
									    <h6><a href="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/" title="">Chaos is a Go-based Swiss army knife of malware</a></h6>
									    <div class="post_detail post_date">
								      		<span class="post_info_author">
								      											      			<a href="https://blog.lumen.com/author/black-lotus-labs/">Black Lotus Labs</a>
								      		</span>
								      		<span class="post_info_date">
								      			September 28, 2022								      		</span>
									  	</div>
									</div>
							    </div>
							</div>
						</div>
									<div class="one_half last">
							<div class="post_wrapper grid_layout">
														<div class="post_img small static">
								    <a href="https://blog.lumen.com/commitment-free-cloud-connectivity/">
								    									    	<img src="https://blog.lumen.com/wp-content/uploads/2022/09/commitment-free-cloud-700x466.jpeg.pagespeed.ce.4eiCWFvkOS.jpg" alt="" class="" style="width:700px;height:466px;"/>
								    </a>
								</div>
														<div class="blog_grid_content">
									<div class="post_header grid">
									    <h6><a href="https://blog.lumen.com/commitment-free-cloud-connectivity/" title="">Commitment-free Cloud Connectivity</a></h6>
									    <div class="post_detail post_date">
								      		<span class="post_info_author">
								      											      			<a href="https://blog.lumen.com/author/molly-moser/">Molly Moser</a>
								      		</span>
								      		<span class="post_info_date">
								      			September 27, 2022								      		</span>
									  	</div>
									</div>
							    </div>
							</div>
						</div>
						  	</div>
						
						
						
						  	<h5 class="single_subtitle">You may also like</h5>
			  	<div class="post_related">
			    			       <div class="one_third ">
					   <!-- Begin each blog post -->
						<div id="post-14249" class="post-14249 post type-post status-publish format-standard has-post-thumbnail hentry category-4th-industrial-revolution category-business-advice category-customer-experience category-data-driven-business category-edge-compute category-healthcare category-industries category-network category-technologies category-technology tag-4ir tag-adaptive-network tag-connected-security tag-diversity tag-financial-services tag-healthcare tag-startups">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/a-pioneering-spirit-builds-a-sustainable-future-in-the-u-s-mountain-region/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2022/09/mountain-region-700x466.jpeg" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/a-pioneering-spirit-builds-a-sustainable-future-in-the-u-s-mountain-region/" title="A pioneering spirit builds a sustainable future in the U.S. Mountain Region">A pioneering spirit builds a sustainable future in the U.S. Mountain Region</a></strong>
									    <div class="post_attribute info_date">
									        September 23, 2022									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			       <div class="one_third ">
					   <!-- Begin each blog post -->
						<div id="post-14087" class="post-14087 post type-post status-publish format-standard has-post-thumbnail hentry category-business-advice category-customer-experience category-industries category-network category-technologies category-technology tag-connected-security tag-customer-experience tag-dedicated-internet-access tag-network tag-remote-work tag-the-lumen-platform tag-video-streaming tag-zoom">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/5-reasons-to-choose-dedicated-internet-access/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2022/08/Blog-5-reasons-700x466.png" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/5-reasons-to-choose-dedicated-internet-access/" title="5 Reasons to Choose Dedicated Internet Access">5 Reasons to Choose Dedicated Internet Access</a></strong>
									    <div class="post_attribute info_date">
									        September 15, 2022									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			       <div class="one_third last">
					   <!-- Begin each blog post -->
						<div id="post-14119" class="post-14119 post type-post status-publish format-standard has-post-thumbnail hentry category-industries category-public-sector category-security tag-connected-security tag-cybersecurity tag-public-sector tag-socaas tag-zero-trust-maturity-model">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/got-socaas-how-automation-can-alleviate-cybersecurity-burnout/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2022/08/Got-SOCaaS-burnout-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/got-socaas-how-automation-can-alleviate-cybersecurity-burnout/" title="Got SOCaaS? How Automation Can Alleviate Cybersecurity Burnout">Got SOCaaS? How Automation Can Alleviate Cybersecurity Burnout</a></strong>
									    <div class="post_attribute info_date">
									        August 22, 2022									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			  	</div>
						
						
						
	    </div>
	    
	</div>

</div>
<!-- End each blog post -->



						
    	</div>

    		<div class="sidebar_wrapper">
    		
    			<div class="sidebar_top"></div>
    		
    			<div class="sidebar">
    			
    				<div class="content">

    							    	    		<ul class="sidebar_widget">
		    	    		<li id="custom_html-7" class="widget_text widget widget_custom_html"><h2 class="widgettitle"><span>Categories</span></h2>
<div class="textwidget custom-html-widget"><p><a href="https://blog.lumen.com/technologies/network/">Adaptive Networking</a></p>
<p><a href="https://blog.lumen.com/technologies/security/">Connected Security</a></p>
<p><a href="https://blog.lumen.com/technologies/cloud/">Hybrid Cloud</a></p>
<p><a href="https://blog.lumen.com/technologies/collaboration/">Communications and Collaboration</a></p>
<p><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Computing</a></p></div></li>
		    	    		</ul>
		    	    	    				
    				</div>
    		
    			</div>
    			<br class="clear"/>
    	
    			<div class="sidebar_bottom"></div>
    		</div>
    
    </div>
    <!-- End main content -->
   
</div>

</div>




<div class="footer_bar   ">

		<div id="footer" class="">
	<ul class="sidebar_widget two">
	    <li id="text-2" class="widget widget_text">			<div class="textwidget"><p><img style="max-width: 220px; height: auto;" src="https://blog.lumen.com/wp-content/uploads/2020/09/Lumen-Logo.png" alt=""/></p>
<div>Lumen is guided by our belief that humanity is at its best when technology advances the way we live and work. With 450,000 route fiber miles serving customers in more than 60 countries, we deliver the fastest, most secure platform for applications and data to help businesses, government and communities deliver amazing experiences.</div>
<div style="margin-top: 15px;"><div class="social_wrapper shortcode light large"><ul><li class="facebook"><a target="_blank" title="Facebook" href="https://www.facebook.com/lumentechnologies" rel="noopener"><i class="fa fa-facebook"></i></a></li><li class="twitter"><a target="_blank" title="Twitter" href="http://twitter.com/lumentechco" rel="noopener"><i class="fa fa-twitter"></i></a></li><li class="youtube"><a target="_blank" title="Youtube" href="https://www.youtube.com/lumentechnologies" rel="noopener"><i class="fa fa-youtube"></i></a></li><li class="linkedin"><a target="_blank" title="Linkedin" href="https://www.linkedin.com/company/lumentechnologies/about/" rel="noopener"><i class="fa fa-linkedin"></i></a></li><li class="instagram"><a target="_blank" title="Instagram" href="http://instagram.com/lumentechnologies" rel="noopener"><i class="fa fa-instagram"></i></a></li></ul></div></div>
</div>
		</li>
<li id="custom_html-12" class="widget_text widget widget_custom_html"><div class="textwidget custom-html-widget"><iframe width="560" height="316" src="https://www.youtube.com/embed/tqiYhn2fQIY?rel=0" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe></div></li>
	</ul>
	</div>
	<br class="clear"/>
	
	<div class="footer_bar_wrapper ">
			    <div id="copyright">Services not available everywhere. ©2022 Lumen Technologies. All Rights Reserved.</div>	    
	    	    	<a id="toTop"><i class="fa fa-angle-up"></i></a>
	    	    
	    	</div>
</div>

</div>


<div id="overlay_background">
	<div id="fullscreen_share_wrapper">
		<div class="fullscreen_share_content">
		<div id="social_share_wrapper">
	<ul>
		<li><a class="tooltip" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-facebook marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/&text=Chaos is a Go-based Swiss army knife of malware&url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-twitter marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2022%2F09%2Fmalware.jpg"><i class="fa fa-pinterest marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/"><i class="fa fa-google-plus marginright"></i></a></li>
		<li><a class="tooltip" title="Share by Email" href="mailto:?Subject=Chaos+is+a+Go-based+Swiss+army+knife+of+malware&amp;Body=https%3A%2F%2Fblog.lumen.com%2Fchaos-is-a-go-based-swiss-army-knife-of-malware%2F"><i class="fa fa-envelope marginright"></i></a></li>
	</ul>
</div>		</div>
	</div>
</div>

<div id="overlay_background_search">
	<a id="search_close_button" class="tooltip" title="Close" href="javascript:;"><i class="fa fa-close"></i></a>
	<div class="search_wrapper">
		<div class="search_content">
		    <form role="search" method="get" name="searchform" id="searchform" action="https://blog.lumen.com//">
		        <div>
		        	<input type="text" value="" name="s" id="s" autocomplete="off" placeholder="Enter Keyword"/>
		        	<div class="search_tagline">Press enter/return to begin your search</div>
		        	<button>
		            	<i class="fa fa-search"></i>
		            </button>
		        </div>
		        <div id="autocomplete"></div>
		    </form>
		</div>
	</div>
</div>



		<!-- Google Tag Manager (noscript) snippet added by Site Kit -->
		<noscript>
			<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TLWF636" height="0" width="0" style="display:none;visibility:hidden"></iframe>
		</noscript>
		<!-- End Google Tag Manager (noscript) snippet added by Site Kit -->
		<style id='yarppRelatedCss-css' media='all'>.yarpp-related{margin-bottom:1em;margin-top:1em}.yarpp-related a{font-weight:700;text-decoration:none}.yarpp-related .yarpp-thumbnail-title{font-size:96%;font-weight:700;text-align:left;text-decoration:none}.yarpp-related h3{font-size:125%;font-weight:700;margin:0;padding:0 0 5px;text-transform:capitalize}</style>
<script type='text/javascript' id='ppress-frontend-script-js-extra'>//<![CDATA[
var pp_ajax_form={"ajaxurl":"https:\/\/blog.lumen.com\/wp-admin\/admin-ajax.php","confirm_delete":"Are you sure?","deleting_text":"Deleting...","deleting_error":"An error occurred. Please try again.","nonce":"08d1ce66f5","disable_ajax_form":"false","is_checkout":"0","is_checkout_tax_enabled":"0"};
//]]></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js' id='ppress-frontend-script-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/ilightbox.packed.js.pagespeed.jm.Q-8bl0JlXg.js' id='ilightbox-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.easing.js.pagespeed.jm.buIHz7bp97.js' id='easing-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.sticky-kit.min.js.pagespeed.jm.T_oe5z4ClC.js' id='sticky-kit-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.lazy.min.js' id='lazy-js'></script>
<script type='text/javascript' id='cookie-js'>//<![CDATA[
(function(factory){if(typeof define==='function'&&define.amd){define(['jquery'],factory);}else if(typeof exports==='object'){module.exports=factory(require('jquery'));}else{factory(jQuery);}}(function($){var pluses=/\+/g;function encode(s){return config.raw?s:encodeURIComponent(s);}function decode(s){return config.raw?s:decodeURIComponent(s);}function stringifyCookieValue(value){return encode(config.json?JSON.stringify(value):String(value));}function parseCookieValue(s){if(s.indexOf('"')===0){s=s.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,'\\');}try{s=decodeURIComponent(s.replace(pluses,' '));return config.json?JSON.parse(s):s;}catch(e){}}function read(s,converter){var value=config.raw?s:parseCookieValue(s);return $.isFunction(converter)?converter(value):value;}var config=$.cookie=function(key,value,options){if(arguments.length>1&&!$.isFunction(value)){options=$.extend({},config.defaults,options);if(typeof options.expires==='number'){var days=options.expires,t=options.expires=new Date();t.setMilliseconds(t.getMilliseconds()+days*864e+5);}return(document.cookie=[encode(key),'=',stringifyCookieValue(value),options.expires?'; expires='+options.expires.toUTCString():'',options.path?'; path='+options.path:'',options.domain?'; domain='+options.domain:'',options.secure?'; secure':''].join(''));}var result=key?undefined:{},cookies=document.cookie?document.cookie.split('; '):[],i=0,l=cookies.length;for(;i<l;i++){var parts=cookies[i].split('='),name=decode(parts.shift()),cookie=parts.join('=');if(key===name){result=read(cookie,value);break;}if(!key&&(cookie=read(cookie))!==undefined){result[name]=cookie;}}return result;};config.defaults={};$.removeCookie=function(key,options){$.cookie(key,'',$.extend({},options,{expires:-1}));return!$.cookie(key);};}));
//]]></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.tooltipster.min.js.pagespeed.jm.g4HIv7X6UI.js' id='tooltipster-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/custom_plugins.js.pagespeed.jm.3zCbdOA7Zb.js' id='grandnews-custom-plugins-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/custom.js' id='grandnews-custom-script-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-review/public/js/js.cookie.min.js' id='js-cookie-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/underscore.min.js' id='underscore-js'></script>
<script type='text/javascript' id='wp-util-js-extra'>//<![CDATA[
var _wpUtilSettings={"ajax":{"url":"\/wp-admin\/admin-ajax.php"}};
//]]></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/wp-util.min.js' id='wp-util-js'></script>
<script type='text/javascript' id='wp_review-js-js-extra'>//<![CDATA[
var wpreview={"ajaxurl":"https:\/\/blog.lumen.com\/wp-admin\/admin-ajax.php","loginRequiredMessage":"You must log in to add your review"};
//]]></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-review/public/js/main.js' id='wp_review-js-js'></script>
</body>
</html>
